DirectPayNet

Blog

  • Checkout Security Reinforcement! Protect Your Online Business From A Data Breach

    Checkout Security Reinforcement! Protect Your Online Business From A Data Breach

    Black Friday and Cyber Monday have come and gone, but was your checkout security ready to stop cyber threats?

    Q4 is set to break higher spending records from previous years, particularly in the online shopping space. Projections show spending was set to hit $143.7 billion this year. A huge 14.1% increase over last year. Yet many online shops admitted they felt unprepared should a cyber attack target their online store. Order pages and checkout security top the list of fears, with news of fraud tactics (like e-skimming) dominating the headlines.

    This period is always the busiest time of year for online retailers. High-risk merchants are so busy dealing with huge spikes in traffic and orders. Suspicious behavior is hard to detect and sometimes it can be weeks or months before you notice an issue. Many online merchants only become aware when a high volume of chargebacks are reported. Sometimes resulting in irreparable damage to their merchant account.

    Cyber criminals are aware of these vulnerable points. They see it as an opportunity. Big brands (e.g. Verizon, Home Depot, Equifax and Kmart) have already had payment data stolen. Thus, you need to be extra vigilant to survive this period unscathed.

    So, how do internet merchants establish a secure checkout and avoid a breach?

     

    Checkout security (or lack thereof) poses the biggest threat to online merchants

    First on the list for shoring up cyber defenses is the order page. Order page security can be easily compromised. Whilst there are many types of attacks, the most common method used to steal customer payments data today is e-skimming. Many merchants have fallen victim this type of attack in recent months.

    This method sees attackers gain access to your site either via a successful phishing attempt, brute force attack, XSS (inserting malicious code), or third-party compromise. Once inside they then capture (in real time) the payment information your shoppers enter into each order page. This data is then used to facilitate shopping sprees for high-ticket items, adult entertainment, and expensive electronics.

    As mentioned, third-party compromises are a common method for hackers to harvest valuable customer data. That’s why extra care must be taken when outsourcing web design and development work to cheaper and foreign teams. All it takes is for one lax employee with to completely debilitate a merchant’s website.

    Even a small breach can result in the following consequences for a high-risk merchant:

    • Lost confidence, so customers go to other merchants
    • Online customer complaints and negative reviews
    • Losses due to increased chargebacks and refunds
    • Possible fines and penalties from card networks or your payments provider as well as legal costs required to handle the customer issues and complaints
    • A terminated merchant account, be it MATCH or terminated merchant file (TMF)
    • As a result of the above, going out of business can be a possibility

     

    How can online merchants operating in high-risk verticals increase security?

    Operating in consumer markets such as adult entertainment, health supplements and various subscriptions deems merchants as high risk. Which is why it’s so important to go above and beyond with protecting your customers’ personal data. Here are some tips to increase security within your organization.

    Implement strong unique passwords

    Weak passwords result in over 80% of company data breaches. Ensure portals (e.g. shopping cart, CRM, gateway) used to store customer data have two-factor authentication and a strong password. Strong passwords are at least eight characters. They also contain upper and lowercase letters, numbers and symbols. Passwords should never be shared with anyone. Each user logging in to these portals should have unique, private usernames and passwords.

    Never use the same password for different software like your gateway, CRM or payment provider portal. Consider using a password manager. Never share sensitive information. Also, ensure security questions only contain answers you know so logins can’t be reset.

    Protect devices

    Often hackers look for weakness in devices such as laptops, desktops or cell phones. Protect them with the latest anti-virus software, rigorous firewalls and other tools. It’s also a great idea to have two-factor (or multiple-factor) authentication. Make sure you have timeouts set to a few minutes when it involves accessing customer data. Making it more difficult for attackers to gain access.

    Train employees on how to spot phishing attacks

    Phishing attacks have moved on a long way from emails telling you you’ve won the lottery or a prince who is looking to share his wealth! Citing that all you need to do is send your bank account information across to receive it. Phishing emails today can look identical to those sent by your acquiring bank or suppliers. Therefore, you need train staff to be extra vigilant over this Christmas period.

    Items to look out for include:

    • Obvious spelling and grammatical mistakes in customer names, email addresses or any personal customer data.
    • Having too many customers from the same IP or using the same email address
    • Card numbers that have the same BIN number that appear too often in a short time frame. The BIN number (Bank Identification Number) is the first 6 digits of the card. Often times fraudsters get a list of credit card numbers from the same BIN or have acquired prepaid cards from the same BIN that they plan to use for fraudulent purposes.

     

    Is the mobile version of your website holding back your sales growth? Read these helpful tips on increasing mobile shopping cart conversion rates!

     

    How to reinforce order page data and checkout security

    Poorly bolstered checkout security and order pages provide criminals with clear targets for stealing sensitive data. Thus, every step taken to improve security defenses is crucial. Here’s how to ensure your site is both protected and compliant with modern standards.

    Only store data you need

    First and foremost, you should only store customer data that is critical in the everyday running of your business. Holding on to unnecessary volumes of data could see you lose that information to hackers. Furthermore, you could be risking compliance issues with the Payment Card Industry Data Security Standard (PCI-DSS), General Data Protection Regulation (GDPR), and California Consumer Privacy Act (CCPA).

    Secure your website with encryption

    There is no excuse for your website not to have SSL (Secure Sockets Layer) protocol to encrypt information on your website. Not only do SSL encryption certificates help to protect items such as credit card information, they help to build brand awareness and credibility with customers. Google has even come out and admitted that it penalizes websites that have yet to implement SSL protocols. Not encrypting your data is costing you sales!

    Review third-party software and plugins regularly

    Undertake regular reviews of all the third-party solutions you’re running within your store. Make sure that you know what they are, and if you’re no longer using them, remove them immediately. Never leave an old plugin active. Updates occur for a reason. Not updating plugins provides a back door for hackers to enter your website. The aim should be to reduce the number of third parties accessing your customers’ data while still operating your website.

     

    Security for payment gateways and shopping carts

    All online merchants need to make sure that their checkout pages are up to standard in order to work with popular payment gateways such as NMI. They, like many other providers, stipulate that carts have to be a minimum of Transport Layer Security (TLS) 1.2 standard in order to send transactions. However, merchants should aim for much higher. Merchants will likely need to invest in SSL certificates with the latest version of TLS installed. Free certificates provided with shared hosting no longer cut it for online businesses collecting customers’ private data.

    Of course, there is a positive branding aspect to this upgrade as well. Customers will feel more comfortable when they see a big green padlock at the top of their page when checking out. So, they are less likely to abandon their cart as trust symbols help your conversions. This is particularly the case for consumers who are ordering on mobile versions of your website.

    Merchants should be working with payment gateways that help with security and machine-learning anti-fraud measures such as 3DS2. Also look for providers who take advantage of tokenization technology.

    Tokenization makes customer authentication during purchase possible without affecting the transaction’s security. A token is a random string of characters that replaces sensitive information, such as a 16-digit credit card number. So, a stolen token number is meaningless to cyber criminals.

     

    Follow PCI compliance protocols

    Adhering to PCI security guidelines is a must. Non-compliance fees from card companies are an unnecessary hit to your bottom line over time. Holes in your security could leave your web presence open to an attack so severe that it cripples your business. Breaches as a result of non-compliance have negative consequences. This includes hefty fines, costs associated with forensic research, and huge legal/PR costs. Even worse is the loss of credit card processing if you get MATCH listed or TMF’d.

    Despite those risks, recent surveys have found that only half of companies are compliant. Worse still, increasing numbers of merchants are failing their PCI compliance tests. Compliance is measured by a self-assessment questionnaire which differs for each industry. You can also complete a PCI scan. An approved vendor will inspect your site for vulnerabilities. Make sure to undertake annual audits and relay changes in compliance requirements to web development teams.

     

    Poor checkout security results in negative consequences

    Cyber attackers take advantage of the high volume of holiday season transactions. They do this to test a website’s defenses. Plus, they sneak into website infrastructure undetected. By taking the right action, merchants can mitigate most of the risks associated with holding sensitive consumer data. High-level encryption, strong passwords, regularly-updated software, and tokenization are a few helpful defences. They stop would-be hackers in their tracks.

    Not investing in order page and checkout security at such a crucial time of the time of year can ruin sales for Q4 and permanently thereafter. The effects of a data breach are difficult to overcome for high-risk merchants, especially those that get MATCH listed or TMF’s as a consequence. So, it’s not worth the risk.

    Are secure checkouts and order pages a huge concern? What about the state of your merchant account? Our 10 years of expertise has helped high-risk merchants develop better payment strategies to safeguard their processing capabilities.

    Talk to us today to push your business go to the next level!

  • Facebook Ad Compliance Could Endanger Your Credit Card Processing. Here’s How. (Pt. 1)

    Facebook Ad Compliance Could Endanger Your Credit Card Processing. Here’s How. (Pt. 1)

    Scandals. Congressional Hearings. Regulatory Changes. It’s been a big – and costly – year for Facebook in the US and EU. Facebook was fined £500,000 by the EU’s Information Commissioner’s Office. The company is also required to pay a $5 billion fine to the FTC for its role in the Cambridge Analytica scandal.

    If you rely on Facebook Advertising, it would have been a big year for you too.

    Algorithm changes are impacting marketers. You’ve had to keep up with the many changes in Facebook’s Advertising Policies in its new thrust at improving privacy. Even more important is managing a delicate balance in your marketing. How you wish to advertise your product or service versus complying with Facebooks’s ad rules is a tricky minefield of disapproved ads. It’s even more difficult when you operate in a high-risk merchant category such as supplements, weight loss offers and business opportunities.

    Plus, you probably don’t even realize how many common factors Facebook compliance has with your merchant providers requirements’.

    So, Facebook compliance is not just about privacy and how ads are run. The real danger lies in the implications for your merchant processing. It’s about balancing the delicate line of compliance between both.

    We will attempt to help you get better at balancing Facebook ad compliance and merchant compliance.

     

    From past to present – it’s always been about ads for Facebook

    Facebook has always relied on ad revenue, even from its inception.

    In its early days, Facebook sold advertising space for flyers. It also had only a limited target audience for ads – college students. Facebook has since evolved into the most popular social media platform. To date, it has more than 2.45 billion monthly active users in the third quarter of 2019.

     

     

    With its growth, businesses large and small see Facebook advertising as a marketing must-have. Over 7 million active advertisers make use of the platform to promote their products and services.

    Indeed, Facebook consistently tries to make advertising attractive to marketers. In the past year, there have been several changes, including a 2% decrease in the average price for an ad, while ad impressions grew by 34%. This makes it a compelling arena for advertising targeting. Many popular consumer products in the supplements and biz op niche survive and thrive because of their traffic Facebook ads generate.

    The process of advertising has evolved over the years. Facebook continues to tighten its ad compliance requirements, because of increased scrutiny. For example, health and fitness high-risk merchants could once show before and after claims in their Facebook ads. Now, the platform prohibits these types of ads. 

    Facebook compliance is a delicate balance

    So, you’re working on compliance with Facebook’s many rules. You’re also navigating the intricacies of owning a merchant account as a high-risk business. There are similarities in the compliance requirements for the two. So, you may feel that in adhering to one, you adhere to both. That’s not the case. There are a few differences that you should note.

    Take for example operating in the supplements market selling health, fitness, or weight loss products and services. You could be approved for a merchant account as long as products do not contain banned substances. (Learn more about weight loss merchant accounts.) Your business would be categorized as high-risk and face the issues that come with this.

    Despite having permission to accept credit card payments for this product, you must follow Facebook’s ad policies. Ads targeting specific Facebook users aren’t allowed. Doing so will get you penalized. This can hurt your reputation, sales and future potential.

    Another example is if you operate in the adult products market. For the safety of your Facebook account and merchant processing, your offer must target users 18 and older only. But, your adult products must be free of any nudity or explicit sexual situations.

    Cryptocurrency is another popular online offer. But, it’s forbidden to promote these types of ads on Facebook. And, Facebook’s Product Management Director, Rob Leathern, contends these ads can be misleading or deceptive.

    Facebook compliance policy - Financial offers

    But, there are some similarities

    There are several similarities in the compliance requirements for Facebook advertising and merchant websites. We’ll use nutraceutical companies again as an example. If you sell health supplements to US buyers, you need to be careful of the claims you make. The FTC and FDA have strict guidelines on what you are legally allowed to say about your product. It doesn’t matter if it’s in an ad or on your website/landing page – only verifiable claims are allowed.

    That’s why financial marketing giant, Agora Financial, through one of its subsidiaries (NewMarket Health) is now in court. They are answering to charges brought by the FTC for misleading advertising about reversing Type 2 diabetes.

    Facebook compliance - false claims

    Like merchant services, Facebook has also singled out high-risk verticals like dating and subscriptions. Dating service companies must follow strict guidelines. Subscription service businesses must do the same. In fact, the compliance requirements for subscription services on Facebook are quite similar to those for merchant accounts.

    The requirements include:

    • Empty checkboxes on the landing page so users actively select the service
    • Clear presentation of prices and recurring charges
    • Free trial details must be explicit, especially about what comes after the trial

    Facebook also has more requirements for your ads’ landing pages. They should not be misleading. They should not do bait-and-switch – the ads must be directly related to the product or service you’re advertising. Much like your payment processor’s requirements for your website.

    If you’d like to know more about how high-risk businesses can improve their payment processing, talk to us as DirectPayNet. We service a wide range of high-risk companies just like yours.

     

    Credit Card companies demand more

    People have criticized Facebook for not being transparent. Yet, transparency is actually key in getting approved for merchant processing. Approved merchants have a long list of credit card network compliance requirements. This is especially as it relates to your online offer.

    Some of the must-have elements for your website include:

    • Transparent terms and conditions:
      • Your website terms and conditions must be clear and easy to understand.
    • Detailed privacy policy:
      • Clearly state how and what type of information is collected from visitors to your site.
    • Transparent pricing and payment details:
      • If pricing details would differ by jurisdiction (e.g. US vs Europe), your terms should clearly state and explain this. If there will be recurring payments, this should be explicit.
    • Refund Policy:
      • Make it easy for customers to find your refund policy and write it clearly.
    • Accessible contact information:
      • It should be easy for customers to find your contact details and get in touch with you.
    • Clear product descriptions:
      • This information should be crystal clear. It should cover areas like where and how your products are made, etc.
    • The checkout process and page:
      • Order and checkout pages should be HTTPS compliant and secured including SSL. You should display the credit card logos of the brands you carry (e.g. Visa, MasterCard). The checkout page should disclose any subscription-type payments or recurring billing. This should include the amounts and whether it’s variable.
    • Clear transaction descriptors:
      • The description that would appear on the bank statement after a purchase should be clear so customers can easily recognize the transaction.

    These are in no way the sum total of the website compliance requirements of credit card companies like MasterCard and Visa. Sometimes, there are industry-specific requirements. For example, adult merchants need an age verification pop-up. Streaming business owners must show proof of your license to distribute content.

     

    So, Facebook compliance in a nutshell

    Yes, that was a lot of information in one reading. But, at the end of the day, it’s about keeping your business compliant. Stay abreast of these sometimes-conflicting guidelines across platforms. Plus, if you were following closely, you would also have noticed that the business models with the highest compliance requirements for Facebook are also those verticals classified as high risk by payment providers.

    Failure to adhere to Facebook’s advertising policies could land you in Facebook jail. Violating merchant account terms could land your business on MATCH. Getting both of these positions reversed can be difficult, but not impossible.

    In the next part of this two-part series, learn how to future-proof your business when you rely on Facebook advertising (including managing your reputation). However, if you want to get a head start on better payment channels, contact DirectPayNet.

    We work with all types of high-risk businesses. Our clients are in the electronics, supplements, health, and business coaching industries, to name a few.

    Entrepreneurs have accessed better merchant processing and favorable terms with our help. With over a decade of experience in payment processing, we will raise the bar for your business.

    Email the DirectPayNet team today. Establish a better payment processing strategy for 2020 and beyond.

  • Social Media Management Software Owners Are Leaving Money On The Table

    Social Media Management Software Owners Are Leaving Money On The Table

    It’s a battle for supremacy between social media management software solutions.

    You know Buffer, Hootsuite and others big brands offer simple platforms to better manage many social media profiles.

    New startups are fighting for a share of the market. This is in part due to the rising power of social media in influencing business decisions.

    It also means competitive advantages, and a main one is payment collection processes.

    What do payment processing and the competitiveness of social media management tools have in common? Well, payment processing is a crucial element for the success of the big guys in the industry. To compete, selling your platform internationally is imperative.

    So, is your company competing against or learning from those like Hootsuite and Buffer? Then, you need to enhance your payment channels.

    At DirectPayNet, we stay up to date on everything that affects our clients in the social media market.

    We want to help you understand the challenges this industry faces. And, we want to ensure you have the right tools to collect payments in all your target markets. Let’s look at how you can boost your payment channels, lower your risk, and widen your user base for bigger profits.

     

    So, what does the future look like for social media management software?

    The future for social media management platforms is bright!

    The growing number of online influencers are behind this movement. Bloggers, vloggers and celebrities earn a living through apps like Instagram and Facebook. This is also tied into the consumer base who consume their output.

    Users of Twitter, Facebook and the like must engage with their audience. They need to manage their social media presence to capture attention.

    That’s where your software comes in.

    You sell tools to manage online interactions and collect data to help users enhance their content. But, influencers and creators work in a very competitive market.

    Consumers get inundated with images and videos. Social media platforms are now pushing user-generated content. For example, Facebook wants users to depend more on customer reviews. Plus, “pay to play” is a huge part of managing an online presence and getting in front of buyers.

    Likewise, recruiting influencers and content creators to use your brand is competitive. They are running a business. They need social media tools to better manage ads, posts, images, and other content, all in a timely fashion.

    So, how do you capture their attention?

     

    Increase your competitive advantage through your payment channels

    Your social media platform allows users to manage several social media channels. Similarly, your payment solution should allow you to manage various payment methods.

    One obvious option is credit card processing – using a merchant account. Whether it’s a celebrity, a small company or a corporate brand using your services, they will most certainly be using credit cards to pay for your service. Even regular consumers who prefer to manage their social media through one platform may like using their credit card to pay for a solution.

    In the merchant processing world, some merchants get desperate. They sign up to an easy platform like PayPal or Stripe. Alternatively, they may go to an obscure processor with half-rate features. The fees might be cheap, but so is the software and the customer support.

    Also, having recurring monthly billing increases your fraud and risk. It’s important to work with a payment processor who can help weather the storm when risk gets higher than usual.

     

    High-risk merchant accounts are better suited for social media management software providers

    A merchant’s risk and fraud levels may be high or stray from normal ratios. When working with brands like Stripe or PayPal this can result in closure. It is not uncommon to end up on a TMF or MATCH list if they believe you violated their terms and conditions.

    Visa rules state that if you offer a trial (whether free or discounted), you need expressed authorization from your customer. This applies to when the first rebilling cycle occurs. This may lead to customer drop offs, because they forget or can’t be reached to get consent. To prevent this, try different pricing strategies.

    Some merchants use a smart strategy to stabilize high conversions after the first month subscription. They keep the amount of the subscription the same every month. This will ensure voluntary consent from customers. And, you can to continue to charge them for their monthly subscription.

    You won’t be under pressure to make contact with customers. Yet, it’s important to provide customers with an easy path to cancellation. They may not want to use your social media platform forever.

     

    Implement anti-fraud tools and measures

    It’s important to also assess whether the technology of your payment processor gives you tools to fight fraud and stop orders that may be risky. This is an important balance as you should have the liberty to add fraud mitigation steps without jeopardizing your conversions or creating false negatives. A flexible gateway that understands the nature of your social media platform business is very important and can make a huge difference in your conversions and fraud ratios.

    If you sell higher ticket packages for enterprise level or feature rich social media platform packages, it is all the more important to work with a high-risk payment processor that can help navigate the complexities of high-priced packages. Charging over $500 per month for an enterprise level customer can be very profitable. But, pricing like this creates big risk on the payment processors’ side. Best to be prepared and get a merchant account that can handle these types of scenarios as you scale your social media management software.

    Also, offer ACH payments to US customers buying bigger corporate packages. Some companies prefer monthly debits directly from their bank account instead of using credit.

    Payment processing is not just about credit card fees. Technology and working with someone who understands your business will avoid bottlenecks and merchant account shutdowns that wreak havoc on your business. Be aware of pricing and ensure to work with someone fair who can accommodate your business and scale with you as you need. Learn more about payment processing fees here. Plus, there are many options for credit card processors for SaaS.

    So, how do you choose the right solution? We suggest working with a company that knows your market such as DirectPayNet. We help merchants in high-risk industries such as social media software services find solutions that work for recurring billing, subscriptions, and risk challenges faced by them.

     

    Ways to widen the customer base for your social media software

    Look at your payment processing options. While developing your software or once it is up and running, it is important to have a plan to go to market or add new markets. Once that is done, inform your current payment processor or look for a payment processor who can help you serve this market.

    For example, a US payment processor may not fare well accepting debit cards from European customers, that means loss of revenue for you if Europe is in your sights. Once you reach a sizable amount of revenue from a market it is important to study your conversions and transaction declines. Make sure you adapt to the way that market pays for products and services.

    Finding a payment processor that accommodates a maximum number of cards will only help you convert. For example, some US customers may prefer to sign up to a social media platform that accepts Discover as their Discover card gives them the most points. Although they have other credit cards they may decide to choose another product or service simply based on the payment options available.

    Ensure technology is seamless for all customers. Potential buyers should not see or feel friction in your checkout. Just as your social media management software is mobile friendly so too should your checkout page. It should be clear and simple for users buying on mobile.

     

    Before you expand overseas to widen your consumer base

    When entering a new market, it’s important to understand the size and growth of the opportunity. Also, if you’re expanding to new markets, ensure your software is translated to make it easier for your customers to use it. They will be more engaged and subscribe longer to your service if they find it easy to navigate and use. Prior to setting up offshore, in Europe or other locations, test out your product with your current payment solution and determine the cause for low conversions, if it is at checkout then you have a clue that new payment modes need to be added to scale in that market.

    Offer support in multiple languages if possible, to the very least, ensure your support hours match the regular hours of operation in your market. This will reduce chargebacks and ensure your customers don’t get frustrated trying to reach out to you. Block countries you cannot support or would not be able to use your social media platform with ease. A gateway with good fraud scrubs will have the tools you need to limit your risk and fraud exposure.

    At DirectPayNet, we pay attention to trends in various industries. Our team ensures our merchants are informed of new regulations that may affect their business.

    An ounce of preparation can relieve major headaches down the road. With a trusted professional on your side, navigating payments in various markets will be a breeze.

    Let’s grow your social media manager software company together. Get in touch today.